Anomaly detector, anomaly detection network, and method for detecting abnormal activity

Abstract

An anomaly detector, an anomaly detection network and a method for detecting abnormal activity are provided. An anomaly detector (100) for detecting abnormal activity in a telecommunications network is provided. The anomaly detector (100) comprises: a receiver unit (102) configured to receive a plurality of network measurements (nm) related to the telecommunications network; a model-based mapping unit (104) configured to map the received plurality of network measurements (nm) to an anomaly indicator (ai) via a machine-trained anomaly detection model (106); and an output unit (108) configured to provide an anomaly indicator (ai) indicating abnormal activity in the telecommunications network.

Description

Technical Field

[0001] The present invention relates to an anomaly detector, an anomaly detection network, a method for detecting abnormal activities, a model determination unit, a system and a method for determining an anomaly detection model. Background Art

[0002] As manufacturing becomes more digital, automated, and flexible, wireless communication networks begin to play an increasingly critical role in factory operations. One of the main concerns in such critical wireless networks is the intrusion of external harmful entities and interference in the wireless spectrum. Summary of the invention

[0003] The problems of the prior art are solved by an anomaly detector according to the invention, an anomaly detection network according to the invention, a method for detecting abnormal activities according to the invention, a model determination unit according to the invention, a system according to the invention and a method for determining an anomaly detection model according to the invention.

[0004] A first aspect of the description is directed to an anomaly detector for detecting abnormal activity in a telecommunications network. The anomaly detector comprises: a receiver unit configured to receive a plurality of network measurements related to the telecommunications network; a model-based mapping unit configured to map the received plurality of network measurements to an anomaly indicator via a machine-trained anomaly detection model; and an output unit configured to provide the anomaly indicator, the anomaly indicator indicating the abnormal activity in the telecommunications network.

[0005] The detection of anomalous behavior is not limited to certain measurements, such as frequency bands. Even complex intrusions and intelligent jamming will be detected. Furthermore, complex manual expert analysis of attacks is avoided, as quickly activated countermeasures prevent further damage.

[0006] The described anomaly detection allows for rapid detection of abnormal activities in a telecommunication network. Thus, subsequent reactions to any detected local network disturbances occurring in the telecommunication network are possible. For example, a wireless 5G network in a factory that is part of a telecommunication network benefits because abnormal activities caused by active intruders or infected abnormally behaving network entities can be detected so that countermeasures can be taken.

[0007] Especially if network measurements are available from both the radio part and the wired part of the telecommunications network, unknown correlation patterns in the measurements across the RF measurements and over the wired measurements are detected.

[0008] In summary, telecommunication operators for private and public networks will benefit because the provided method guarantees reliable operation of telecommunication networks by reacting appropriately when anomalies are detected via anomaly indicators.

[0009] An advantageous example is characterized in that the machine trained anomaly detection model has been learned using a training set representing normal behavior of a telecommunication network or another telecommunication network.

[0010] By learning normal behavior, the provided method has the advantage that abnormal behavior can be detected independently of the nature of the abnormal behavior or new attack patterns. Therefore, the provided method is safe with respect to future attack variants.

[0011] Advantageously, the same model can be used for different environments, such as a factory environment, an office environment, a city center environment, etc. However, it is also possible to determine a plurality of models, each model being used for a specific environment.

[0012] A favorable example is characterized in that the anomaly detector includes: a performance indicator mapping unit configured to map the received multiple network measurements to at least one network performance indicator; and a model-based mapping unit configured to map the received multiple network measurements to anomaly indicators via a machine-trained anomaly detection model and based on the at least one network performance indicator.

[0013] Advantageously, the at least one network performance indicator reduces the first dimension of the plurality of network measurements to a second dimension of the at least one network performance indicator, wherein the second dimension is smaller than the first dimension. Thus, the network performance indicator is a representation of the plurality of network measurements. For example, the performance indicator unit calculates a mean network data rate based on a plurality of data rates.

[0014] Advantageous examples are characterized in that the machine trained anomaly detection model comprises an autoencoder.

[0015] The plurality of network measures are mapped to a reconstruction of the plurality of network measures using an autoencoder. The autoencoder determines from the reduced encoding in the form of a latent code a representation as close as possible to its original input in the form of network measures.

[0016] Advantageously, the anomaly detection model has been trained to learn the normal operation of the telecommunication network without abnormal behavior. Therefore, the autoencoder inherently learns the structure and characteristics of normal behavior. If abnormal activity occurs in the telecommunication network, the learned structure and characteristics of the normal operation of the telecommunication network do not apply. This is why in case of abnormal activity in the telecommunication network, the reconstruction of the autoencoder will deviate significantly from the input network measurements.

[0017] An advantageous example is characterized in that the model-based mapping unit determines a reconstruction of the plurality of network measurements and in that the output unit determines the anomaly indicator dependent on the comparison of the network measurements and dependent on the reconstruction of the network measurements.

[0018] For example, determining a difference metric between the network measurement and the reconstruction provides an anomaly indicator. By comparing the current network measurement to the reconstruction, the model-based mapping unit can discover anomalies. For example, if the anomaly indicator exceeds a threshold, the current state of the network measurement is considered to be an abnormal activity and indicates an intrusion or some other adversarial attack.

[0019] An advantageous example is characterized in that the at least one network performance indicator is injected into the machine trained anomaly detection model, wherein the injection location is arranged between an input layer and an output layer of the machine trained anomaly detection model.

[0020] This mapping is done at least in part in parallel with the branching of the machine-trained anomaly detection model. At the injection location, the network performance indicator is merged into the machine-trained anomaly detection model. Thus, the injection advantageously helps reconstruct the network measurements.

[0021] Advantageous examples are characterized in that the machine trained anomaly detection model includes an encoder and a decoder, wherein the encoder provides a latent code at an output section of the encoder, and wherein an input section of the decoder receives the latent code and the at least one network performance indicator.

[0022] Advantageously, the latent code and said at least one network performance indicator are combined at an input layer of the decoder in order to assist in the reconstruction of network measurements.

[0023] An advantageous example is characterized in that network measurements are received from a first plurality of network probes distributed in a radio part of the telecommunication network and from a second plurality of second network probes distributed in a wired part of the telecommunication network.

[0024] The telecommunication network is represented by receiving network measurements from several network probes. The network measurements from the wired portion of the telecommunication network characterize the traffic patterns on the network devices and must generally be correlated with the behavior on the wireless medium over time. That is, if there are strong changes in radio spectrum usage, strong changes in traffic somewhere in the wired plant network are also expected.

[0025] An advantageous example is characterized in that the at least one network probe is a radio frequency spectrum analyzer configured to determine at least one radio resource usage pattern of a radio telecommunication network part of the telecommunication network, wherein the radio resource usage pattern is received as a network measurement.

[0026] Advantageously, radio resource usage patterns may be measured without being vulnerable to intrusion.

[0027] A second aspect described is directed to an anomaly detection network comprising an anomaly detector according to the first aspect and a plurality / s of network probes.

[0028] A third aspect described is directed to a computer-implemented method for detecting abnormal activity in a telecommunications network, wherein the method comprises: receiving a plurality of network measurements related to the telecommunications network; mapping the received plurality of network measurements to anomaly indicators via a machine-trained anomaly detection model; and providing the anomaly indicator indicating the abnormal activity in the telecommunications network.

[0029] According to an advantageous example, the method is adapted to operate an anomaly detector according to the first aspect.

[0030] A fourth aspect of the description is directed to a model determination unit for determining an anomaly detection model, wherein the model determination unit comprises: an aggregator unit configured to aggregate training data comprising a plurality of network measurements of a telecommunications network; and a training unit configured to train the anomaly detection model based on the training data.

[0031] A favorable example is characterized in that the model determination unit includes: a first training unit configured to train an encoder of the anomaly detection model based on a first type of training set, wherein the first type of training set includes: a plurality of network measurements and a prior distribution; and a second training unit configured to train a decoder of the anomaly detection model based on a second type of training set, wherein the second type of training set includes: the plurality of network measurements, potential codes, and at least one network performance indicator.

[0032] Advantageously, the training of the autoencoder is performed by taking into account said at least one performance indicator in order to reconstruct said plurality of network measurements.

[0033] An advantageous example is characterized in that the training data, in particular the first and second type of training data, are collected during normal operation of the telecommunication network without anomalies.

[0034] Advantageously, the anomaly detection model is trained to learn the normal operation of the telecommunications network.

[0035] The fifth aspect described is directed to a system comprising an anomaly indicator according to the first aspect and a model determination unit according to the fifth aspect.

[0036] A sixth aspect described is directed to a computer-implemented method for determining an anomaly detection model, wherein the method comprises: aggregating training data comprising a plurality of network measurements of a telecommunications network; and training the anomaly detection model based on the training data.

[0037] According to an advantageous example, the method is adapted to operate a model determination unit according to the fifth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 and Figure 2 depicts a schematic block diagram of an anomaly detector;

[0039] Figure 3 An exemplary telecommunications network is depicted;

[0040] Figure 4 Schematically depicts the structure of an autoencoder;

[0041] Figure 5 Schematically depicting the training of an autoencoder's encoder;

[0042] Figure 6 schematically depicting the training of a decoder of an autoencoder; and

[0043] Figure 7 The model determination unit is schematically depicted. DETAILED DESCRIPTION

[0044] Figure 1 A schematic block diagram of an anomaly detector 100 is depicted, which is configured for detecting abnormal activity in a telecommunication network. A receiver unit 102 is configured to receive a plurality of network measurements nm related to an observed telecommunication network. A model-based mapping unit 104 is configured to map the received plurality of network measurements nm to anomaly indicators ai via a machine-trained anomaly detection model 106. An output unit 108 is configured to provide anomaly indicators ai, which indicate abnormal activity in the telecommunication network.

[0045] Network measurements nm related to the telecommunication network include measurements like throughput, signal strength, QoS, radio usage, line usage, etc., which are sensed by network probes distributed over the telecommunication network. Network measurements nm include network measurements from the radio domain and network measurements from the wired domain.

[0046] The machine trained anomaly detection model 106 has been learned using a training set representing the normal behavior of a telecommunications network or another telecommunications network. Thus, the learning of normal network behavior is accomplished using, for example, data from a radio frequency spectrum analyzer and data from network probes deployed on wired network devices within the factory, such as routers, switches, edge servers, or terminal devices. The network monitoring probes provide measurements such as throughput, round trip time, number of TCP / UDP / IP flows, jitter, packet inter-arrival time, packet size, etc.

[0047] A computer-implemented method for detecting abnormal activity in a telecommunications network comprises: receiving a plurality of network measurements nm related to the telecommunications network; mapping the received plurality of network measurements nm to anomaly indicators ai via a machine trained anomaly detection model 106; and providing anomaly indicators ai indicating abnormal activity in the telecommunications network.

[0048] When the abnormal indicator ai indicates an abnormality, at least one of the following actions is performed:

[0049] - Anomalies must be evaluated by an expert and marked as genuine.

[0050] - Reactions to anomaly detection can be automated or triggered by humans, e.g. shutting down certain devices, changing network configuration until the problem is resolved.

[0051] -The data that led to the anomaly detection can be used to train the model. This is particularly useful when anomalies are expected to occur in the future.

[0052] In case no anomalies are detected or after evaluation, the anomalies are identified as false, the data can be reused again in the training part to improve the performance.

[0053] Figure 2 A schematic block diagram of the anomaly detector 100 is depicted in more detail. The performance indicator mapping unit 202 is configured to map the received plurality of network measurements nm to at least one network performance indicator npi. The model-based mapping unit 104 is configured to map the received plurality of network measurements nm to anomaly indicators ai via a machine-trained anomaly detection model 106 and in dependence on the at least one network performance indicator npi. The machine-trained anomaly detection model 106 comprises an autoencoder.

[0054] The model-based mapping unit 104 determines a reconstruction rec of the plurality of network measurements nm. The output unit 108 determines anomaly indicators ai depending on the comparison of the network measurements nm and depending on the reconstruction rec of the network measurements nm.

[0055] At least one network performance indicator npi is injected into the machine-trained anomaly detection model 106. The injection location is arranged between the input layer and the output layer of the machine-trained anomaly detection model 106.

[0056] The receiver unit 102 selects network measurements nm and distributes them to the model-based mapping unit 104 and the performance indicator unit 202. For example, the network measurements for the model-based mapping unit 104 and the performance indicator unit 202 are the same, different or partially overlapping.

[0057] Figure 3 An exemplary telecommunication network 300 is depicted. The telecommunication network includes a radio portion and a wired portion. The radio portion consists of wireless terminal devices and a gateway device to the wired portion of the telecommunication network 300. The wired portion of the telecommunication network 300 includes servers, switches, and gateway devices.

[0058] The anomaly detection network 302 comprises the anomaly detector 100 and a plurality of network probes P. Network measurements nm are received from a plurality of different network probes P distributed over the telecommunication network 300 .

[0059] Spread over the radio portion of the telecommunications network 300, the anomaly detection network 302 includes wireless network detectors P1, P2, and P3. Spread over the wired portion of the telecommunications network 300, the anomaly detection network 302 includes wireless network detectors P4 to P10. Thus, the detectors P1 to P10 monitor traffic across corresponding network components in the telecommunications network 300.

[0060] The network probes Pspec1 and Ppsec2 are radio frequency spectrum analyzers configured to determine at least one radio resource usage pattern rrup1, rrup2 of a radio telecommunication network part RCN of the telecommunication network 300. The anomaly detector 100 receives the radio resource usage pattern rrup1, rrup2 as network measurements nm. The network probes Pspec1 and Ppsec2 scan the usage of the wireless medium and specific frequency bands of interest.

[0061] Figure 4 The structure of the autoencoder is schematically depicted. The machine trained anomaly detection model 106 comprises an encoder ENC and a decoder DEC. The encoder ENC provides a latent code lc at an output section of the encoder ENC. The input section of the decoder DEC receives the latent code lc and at least one network performance indicator npi.

[0062] Figure 4 A schematic arrangement is depicted for determining a tensor representing a reconstruction rec(nm) of a network measurement nm via an encoder ENC comprising an artificial neural network and a decoder DEC comprising an artificial neural network, wherein the reconstruction rec(nm) is determined based on the network measurement nm. The encoder ENC and the decoder DEC together provide an autoencoder representing the anomaly detection model 106 of the previous figure.

[0063] The encoder ENC is trained to efficiently compress network measurements, including, for example, radio measurement data (e.g., RF spectrum, signal strength map, etc.) into a potential code lc. The decoder DEC is then trained to reconstruct the radio measurement data from the potential code z. As auxiliary information, network performance indicators npi (e.g., throughput, round-trip time, etc.) are fed into the decoder DEC together with the potential code lc to assist the reconstruction task of the decoder. Through the training process, the autoencoder learns the implicit structure behind the training data. This knowledge can then be used to detect anomalies at test time. In other words, the structure of the anomaly is unlikely to be the same as the training data. Therefore, the reconstruction error of the expected autoencoder is large.

[0064] At test time, the autoencoder compresses the network measurements and then reconstructs them with the help of the network performance indicators. The reconstruction error is measured and compared against a threshold. If the reconstruction error is greater than the threshold, the anomaly detector reports the presence of an anomaly. To design the threshold, the mean and variance of the reconstruction error on the training set (normal case) are calculated. The threshold can then be set to a multiple of the mean plus the standard deviation.

[0065] The layout used for training is Figure 5 and Figure 6 As shown in . First, refer to the training of the encoder ENC.

[0066] according to Figure 5 , the network measurements nm of the training set are provided by the input interface 502 of the encoder ENC in the form of input data id. The arrangement comprises an encoder ENC having an input layer 504. For time step i, the input tensor nm of input data id i is passed to the input layer 504. The input layer 504 is part of the input segment. For the input data id, the output O is determined in the form of a prior distribution PRIOR of the potential code lc so as to constrain the potential code lc. In time step i, the observation value lc with the potential code lc is determined i A tensor of . Each time series of input data id is assigned to one of the input nodes. In the forward path of the encoder ENC, the input layer 504 is followed by at least one hidden layer. For the encoder ENC, the number of nodes of the at least one hidden layer is less than the number of input nodes. This number is to be considered as a hyperparameter. In this example, three nodes are provided in the hidden layer. For example, the encoder ENC is learned by a gradient descent method in the form of backpropagation. In the forward path in this example, an output layer 506 is provided after the at least one hidden layer. Prediction values ​​are output at the output layer 506 of the output section of the encoder ENC. In this example, an output node is assigned to each prediction value.

[0067] In addition to the reconstruction loss, the latent code z of the autoencoder is constrained to avoid the trivial solution that the encoder ENC and the decoder DEC jointly form an identity mapping from the autoencoder input to its output. The prior distribution of the latent code lc is chosen to be PRIOR = p prior (Ic), the encoder ENC is not only trained to efficiently encode the input for subsequent decoding, but also to distribute ∫p enc (rec|nm)p(nm)dnm=p enc (lc) and the prior p prior (lc) matches.

[0068] At each time step i, the training function 508 constrains the learning process to the observation value lci A training set that matches the prior distribution PRIOR. In this example, this matches the observed values ​​lc of the latent code lc i The column vector of is fed to the training function 508. In this example, the training function 508 is designed to determine the prediction error by means of a loss function LOSS, in particular by means of a mean square error, and to train the encoder ENC with it and by means of an optimizer (e.g., an Adam optimizer). In this example, the loss function LOSS depends on the observation value lc i It is determined by the deviation of the tensor value and the prior distribution PRIOR, in particular the mean square error.

[0069] Once a fixed criterion is reached, the training ends. In this example, if the loss does not decrease over a number of time steps - that is, in particular, the mean squared error does not decrease, then the training is terminated.

[0070] The test data is then entered into the encoder ENC trained in this way. The encoder ENC is generated by training with the training data. The encoder ENC is evaluated with the test data, in particular with respect to the mean μ and the covariance Σ.

[0071] according to Figure 4 In the arrangement shown in , a trained machine learning encoder ENC is used to provide a low-dimensional representation of the network measurement nm. The same data preprocessing steps are performed for the training data. For example, the scaling and determination of the input and output data occurs. In this example, the determination occurs during the operation of the anomaly detector 100 of the previous figure.

[0072] As described for training, for time step i, for input data id, the input tensor nm i is passed to the input layer 504. Afterwards, in contrast to training, the decoder DEC receives the value lc of the latent code lc i .

[0073] according to Figure 6 , schematically depicting the training of the decoder DEC. The input interface 602 of the decoder DEC provides a tensor in the form of input data id, which includes the value lc of the potential code lc of the training set i and has the value npi of the network performance indicator npi for the training set i The training arrangement comprises a decoder DEC having an input layer 604. For time step i, an input tensor of input data id is passed to the input layer 604. The input layer 604 is part of the input segment. For input data id, the output O is Figure 5 The network measures nm with an input tensor nm i The network measures the input tensor nm of nm in the form of iis called the known training tensor nm i train At time step i, determine the observed value rec(nm) of the reconstruction rec with network measurements nm i A tensor of . Each time series of input data id is assigned to one of the input nodes. In the forward path of the decoder DEC, the input layer is followed by at least one hidden layer. For the decoder DEC, the number of nodes of the at least one hidden layer is greater than the number of input nodes receiving the potential code. This number is to be considered as a hyperparameter. In this example, three nodes are provided in the hidden layer. For example, the decoder DEC is learned by a gradient descent method in the form of back propagation.

[0074] In the forward path in this example, an output layer 606 is provided after the at least one hidden layer. At the output layer 606 of the output section of the decoder DEC, a tensor rec(nm) is output. i In this example, an output node is assigned to each predicted value.

[0075] At each time step i, determine the tensor nm i train , which contains the tensor rec(nm) for this time step i i In this example, this corresponds to the observed value rec(nm) of the network measurement nm. i train The column vector of is fed to the training function 608. In this example, the training function 608 is designed to determine the prediction error by means of a loss function LOSS, in particular by means of a mean square error, and to train the decoder DEC with it and by means of an optimizer (e.g., an Adam optimizer). In this example, the loss function LOSS is a function that depends on the observation value rec(nm) i The tensor value and training tensor nm i train The deviation, especially the mean square error, is used to determine the

[0076] Once a fixed criterion is reached, the training ends. In this example, if the loss does not decrease over a number of time steps - that is, in particular, the mean squared error does not decrease, then the training is terminated.

[0077] The test data are then entered into the decoder DEC trained in this way. The decoder DEC is generated by training with the training data. The decoder DEC is evaluated with the test data, in particular with respect to the mean μ and the covariance Σ.

[0078] according to Figure 4, a trained machine learning decoder DEC is used to provide a reconstruction of the input data of the encoder ENC based on a low-dimensional representation of the network measurement nm in the form of a potential code lc and based on the network performance indicator npi. The same data preprocessing steps are performed for the training data. For example, scaling and determination of the input and output data occurs. In this example, the determination occurs during the operation of the anomaly detector 100 of the previous figure.

[0079] The input data id is entered into the trained decoder DEC. Depending on this, the prediction value is determined. Depending on this, the determination score is determined.

[0080] As described for training, for time step i, the column vector is passed to the input layer 604. Thereafter, in contrast to training, the output unit 108 compares the reconstruction rec(nm) with the network measurements nm and determines anomaly indicators ai.

[0081] In particular, instructions for a computer program implementing the described encoder ENC or decoder DEC are provided for the implementation of the described process. Dedicated hardware may also be provided, in which the trained model is mapped.

[0082] Figure 7 Schematically depicted is a model determination unit 700 for determining an anomaly detection model 106. An aggregator unit 702 is configured to aggregate training data comprising a plurality of network measurements nm of the telecommunication network 300. A training unit 704 is configured to train the anomaly detection model 106 in dependence on the training data.

[0083] The aggregator unit 702 collects training data. The training data, in particular the first and second types of training data td1, are collected during normal operation of the telecommunication network 300 without anomalies. Thus, during normal operation, the most common and typical operations of the network and the plant are done.

[0084] The first training unit 500 is configured to train the encoder ENC of the anomaly detection model 106 according to a first type of training set ts1 , wherein the first type of training set ts1 includes: a plurality of network measurements nm and a prior distribution PRIOR.

[0085] The second training unit 600 is configured to train the decoder DEC of the anomaly detection model 106 according to a second type of training set ts2, wherein the second type of training set ts2 includes: a plurality of network measurements nm, a potential code lc and at least one network performance indicator npi.

[0086] After the aggregation of training data, the model is constructed via training units 500 and 600. In an example, this step also includes identifying the main information sources and their relevance.

[0087] A system includes the anomaly indicator 100 of the previous figure and a model determination unit 700 .

[0088] A computer-implemented method for determining an anomaly detection model 106 includes: aggregating training data including a plurality of network measurements nm of a telecommunications network 300; and training the anomaly detection model 106 based on the training data.

Claims

1. An anomaly detector (100) for detecting abnormal activity in a telecommunications network (300), wherein the anomaly detector (100) comprises: a receiver unit (102) configured to receive a plurality of network measurements (nm) related to a telecommunications network (300); A performance indicator mapping unit (202) configured to map the received plurality of network measurements (nm) to at least one network performance indicator (npi); a model-based mapping unit (104) configured to map the received plurality of network measurements (nm) to anomaly indicators (ai) via a machine-trained anomaly detection model (106) and in dependence on the at least one network performance indicator (npi); and An output unit (108) is configured to provide an anomaly indicator (ai) indicating abnormal activity in the telecommunications network (300); wherein the machine trained anomaly detection model (106) comprises an autoencoder, the autoencoder comprising an encoder (ENC) and a decoder (DEC), wherein the encoder (ENC) compresses a received plurality of network measurements (nm) into a latent code (lc), and the decoder (DEC) receives the latent code (lc) and the at least one network performance indicator (npi).

2. The anomaly detector (100) according to claim 1, wherein: A machine trained anomaly detection model (106) has been learned using a training set representing normal behavior of the telecommunications network (300) or another telecommunications network.

3. An anomaly detector (100) according to claim 1, wherein the model-based mapping unit (104) determines a reconstruction (rec) of the plurality of network measurements (nm), and wherein the output unit (108) determines an anomaly indicator (ai) based on the comparison of the network measurements (nm) and based on the reconstruction (rec) of the network measurements (nm).

4. The anomaly detector (100) according to claim 1 or 2, wherein: Network measurements (nm) are received from a plurality of first network probes (P) distributed in a radio part of a telecommunication network (300) and from a plurality of second network probes (P) distributed in a wired part of the telecommunication network (300).

5. An anomaly detector (100) according to claim 4, wherein at least one of the network probes (P) is a radio frequency spectrum analyzer, which is configured to determine at least one radio resource usage pattern (rrup1, rrup2) of a radio telecommunication network part (RCN) of the telecommunication network (300), wherein the radio resource usage pattern (rrup1, rrup2) is received as a network measurement (nm).

6. An anomaly detection network (302) comprising a plurality of network probes (P) and an anomaly detector (100) according to any one of the preceding claims.

7. A computer-implemented method for detecting abnormal activity in a telecommunications network (300), wherein the method comprises: receiving a plurality of network measurements (nm) associated with a telecommunications network (300); mapping the received plurality of network measurements (nm) to at least one network performance indicator (npi); mapping the received plurality of network measurements (nm) to anomaly indicators (ai) via a machine trained anomaly detection model (106) and in dependence upon the at least one network performance indicator (npi); and providing an anomaly indicator (ai) indicating abnormal activity in the telecommunications network (300); The machine trained anomaly detection model (106) comprises an autoencoder, the autoencoder comprising an encoder (ENC) and a decoder (DEC), wherein the encoder (ENC) compresses a plurality of received network measurements (nm) into a latent code (lc), and the decoder (DEC) receives the latent code (lc) and the at least one network performance indicator (npi).

8. A computer implemented method according to claim 7, wherein the method is adapted to operate an anomaly detector (100) according to claims 1 to 5.

9. A system comprising an anomaly detector (100) according to any one of claims 1 to 5 and a model determination unit (700) for determining an anomaly detection model (106), wherein the model determination unit (700) comprises: an aggregator unit (702) configured to aggregate training data comprising a plurality of network measurements (nm) of the telecommunication network (300); The training unit (704) is configured to train the anomaly detection model (106) according to the training data.

10. The system according to claim 9, wherein the model determination unit (700) comprises: A first training unit (500) is configured to train an encoder (ENC) of an anomaly detection model (106) based on a first type of training set (ts1), wherein the first type of training set (ts1) includes: a plurality of network measurements (nm) and a prior distribution (PRIOR); and A second training unit (600) is configured to train a decoder (DEC) of the anomaly detection model (106) based on a second type of training set (TS2), wherein the second type of training set (TS2) includes: a plurality of network measurements (NM), a potential code (LC) and at least one network performance indicator (NPI).

11. The system of claim 9 or 10, wherein the training data is collected during normal operation of the telecommunications network (300) without anomalies.

Images